LiteLLM Data Breach: 40 Minutes That Exposed 2,500 Companies

Stolen Credentials, Not Stolen Conversations, and a Headcount That Keeps Shifting

Nobody's AI chatbot conversation got leaked here. Nobody's prompts were read in real time, and no chat history sat exposed.

Attackers stole something else: the keys that let automated systems talk to AI providers and other services on a company's behalf. That's a different risk category, credential theft rather than content exposure.

A CI/CD pipeline is the automated system a company uses to build, test, and ship its own code. It often holds the same API key powering the AI tool an employee uses at work. CloudSEK's report turned that quiet fact into this week's headline.

Even the organization count itself keeps shifting.

Three different tallies are circulating, and CloudSEK's own report cautions its figures describe reconstructed exposure, not confirmed compromise of every listed company. The honest takeaway is “in the low thousands,” not a precise headcount.

Some later coverage, including Hudson Rock's August 13 disclosure, names additional organizations such as Microsoft, not confirmed against CloudSEK's own primary report.

Security researchers flag a pattern here: cloud AI tools and the infrastructure around them have become a favorite target, since one gateway touches everything routed through it. For most readers, that's the smaller risk unless your own data moved through a downstream platform like Mercor.

• What lives inside a pipeline: the same OpenAI or Anthropic key powering a company's internal AI assistant, sitting next to AWS and database credentials.
• The three counts in circulation and where each comes from: CloudSEK says “2,500+,” Hudson Rock's own separate August 13 disclosure counts 2,488 corporate domains, and The Hacker News reports “2,100+.”
• CloudSEK's own caveat, stated plainly: its exposure figures are reconstructed from data, not proof that every named organization was actually compromised. No outlet, including CloudSEK itself, has explained why the three counts differ.
• The FBI's July 2 FLASH advisory warned that credentials stolen in this campaign will likely keep getting weaponized for months.

Inside the Chain: How a Trusted Security Scanner Became the Backdoor

LiteLLM isn't a chatbot anyone types into. It's plumbing: software a company installs so its internal tools can talk to OpenAI, Anthropic, and other AI providers through one connection. Most employees would never see it or know its name.

Attackers broke in somewhere else entirely first. They compromised Trivy, a security scanner built by Aqua Security, using a login token that should have been retired weeks earlier. LiteLLM's own build system pulled in that compromised version, which handed attackers a direct path to LiteLLM's PyPI publishing credentials.

A clear timeline answers the “is this old news” question. Trivy was compromised on March 19, the backdoored LiteLLM packages sat live on PyPI for about 40 minutes on March 24, and a clean rebuild shipped March 30.

LiteLLM's own statement called it a suspected supply chain incident, and the full public scale only surfaced five months later, in CloudSEK's August report.

• Independent practitioner framing: developer Dylan Oh put it bluntly: “Compromise LiteLLM, and you get the keys to everything.”
• The technical detail that made it worse: the backdoor rode in through a .pth file, a Python feature that auto-runs on every process startup, not just when litellm itself is imported, so it could fire in scripts that never touched the library.
• What the fake packages did once installed: quietly copied cloud passwords, API keys, and other credentials, encrypted the haul, and sent it to a server outside LiteLLM's control.
• CVE-2026-33634, the tracking number security teams use for this exact flaw (March, the supply-chain root cause), and CVE-2026-42208 (April, an unrelated login-system bug) are two separate incidents a month apart. LiteLLM's own blog post on the second never once references the first.
• Commenters on the maintainer's own GitHub thread point to a fix mainstream coverage barely mentions: short-lived login tokens instead of long-lived secrets stored as CI environment variables.

The Part Nobody's Covering: A Fake Compliance Industry, a Named Attacker, and a Ransomware Payoff

TeamPCP is the name researchers use for the group behind this, tracked by Trend Micro as SHADOW-WATER-058 and assessed as financially motivated, with no confirmed state ties. The same group ran a campaign across several developer ecosystems that March; LiteLLM was the fifth and final target, not the whole story.

Oligo Security traced a six-year attack trail to a 2020 predecessor and an earlier campaign against exposed AI clusters.

Part of why 2,500-plus organizations' vetting missed this: the compliance paperwork many relied on was fake. A March 2026 whistleblower found that 493 of 494 SOC 2 reports from YC-backed Delve Technologies, the security-audit certificates companies use to prove they're trustworthy, shared identical boilerplate text, including the same grammatical errors.

LiteLLM's own certification was one of the 493 fraudulent audits, and Y Combinator removed Delve from its startup directory over it.

AI staffing platform Mercor was breached through the same hole. That exposed roughly 4TB of data tied to more than 40,000 lawyers, physicians, and other professionals, though Mercor calls that group “a very limited subset” of its nearly five million registered experts.

Mercor's own breach adds a sharper detail than “biometrics.” Contractors ran monitoring software capturing screenshots every 30 to 60 seconds. Litigation alleges the captures indiscriminately recorded proprietary code, banking details, and privileged communications belonging to third parties, not just contractors.

None of this is unique to AI tooling. It echoes Vercel's own breach earlier in 2026, where the entry point was ordinary infrastructure, not the AI model. Trusted tools sit closer to more systems than anyone accounts for.

• TeamPCP's ransomware partner VECT is now confirmed operational by multiple security vendors, not just claimed. Sophos, Vectra AI, and Infosecurity Magazine each report at least one real ransomware deployment using credentials from an estimated 300GB, 500,000-credential archive spanning the Trivy, Checkmarx, LiteLLM, and Telnyx compromises.
• The historical comparison: named security firms call this the most consequential DevSecOps supply-chain attack since XZ Utils in 2024, achieved in days through a credential-rotation gap, not years of social engineering.
• The Hacker News thread on the Mercor breach called the Delve leak “basically a shortlist of targets for hackers to try now.”
• Independent researchers who reviewed the leaked archive break the data down further: roughly 211GB of candidate records including Social Security numbers, about 3TB of interview video and ID scans, and nearly 940GB of platform source code, a breakdown Mercor itself has not confirmed.
• Y Combinator's Garry Tan reportedly said in a leaked post: “We have asked Delve to leave YC. YC is a community, not just an accelerator.” Insight Partners quietly scrubbed its own Delve investment writeup soon after.

What This Actually Means for You, Even If You've Never Heard of LiteLLM

Most people reading this will never install LiteLLM or type its name into a search bar. Plenty of company AI tools are wired through gateways like it without employees being told.

If you use ChatGPT, Claude, or Gemini through your own personal account, this specific breach did not touch you. It targeted the shared proxy layer companies install, not individual consumer accounts. Mercor's own update shows where the real exception lives: platforms that route your data through infrastructure you never chose.

There's no way to check this from the outside, unlike if NVIDIA or Deloitte issued a public response. The honest move is asking IT whether the company uses LiteLLM, and whether affected credentials were tested after rotation, not just claimed.

If you're not an admin or engineer, there's no personal password this breach exposed. That work belongs to IT teams rotating infrastructure credentials, not individual employees changing their own logins.

• Three direct questions worth bringing to IT: whether the company uses LiteLLM or a similar proxy, whether it appeared in CloudSEK's exposure list, and whether affected credentials have actually been tested after rotation.
• Why “we already fixed it” deserves a second look: security researcher Kevin Beaumont tested credentials an unnamed organization claimed were fully rotated, under responsible-disclosure rules, and found almost every one still worked.
• The credential-versus-content distinction from earlier still applies here: nothing in this specific breach touches anything typed into a chatbot.
• Anyone who did freelance or contract AI work through a platform like Mercor should check specifically whether their own registration data was part of the disclosed archive.
• For anyone rethinking how they use AI tools at work more broadly, Elephas has an AI data safety playbook worth reading.

Where Elephas Fits: A Narrower, More Direct Way to Use AI

Infrastructure and stolen credentials sit at the center of this breach, a different risk category from someone pasting sensitive text into a chatbot. Elephas does not sit inside CI/CD pipelines and would not have prevented this specific breach. That's worth saying plainly, not as a hedge buried at the end.

Every extra system between a person, or a pipeline, and an AI model is one more place that can be compromised. Each Elephas user connects their own cloud AI accounts directly, rather than through one shared, centralized proxy.

For researchers who still want a leading cloud model, Elephas adds a second layer through automatic PII redaction. Before a prompt is sent to ChatGPT, Claude, Gemini, Grok, Perplexity, or any other cloud model, Elephas strips sensitive names, emails, phone numbers, and identifiers on your Mac. The cloud model only ever sees the sanitized text.

Sensitive data is automatically detected and redacted before anything reaches a cloud AI model. Your content is never used to train AI models, it never sits on a vendor's server, and nothing passes through a third-party reviewer's screen.

Redacted fields get reassembled locally on your machine once the answer comes back, so identifiable information never leaves the device. Elephas has a free plan and starts at $19/month. Try Elephas for free if a more direct way to use AI sounds like the right trade.

• Smart Redaction is available on every Elephas plan, including Free, not gated to a paid tier.
• Elephas also has built-in, fully local, offline AI models, removing cloud dependency entirely for anyone who wants that option.
• There's no centralized, organization-wide credential store: each user's connection to their chosen AI provider is their own, not a shared proxy serving thousands of accounts.
• What Elephas does not claim: a CI/CD security tool, engineering-secrets management, or a fix for this specific breach. The value on offer is narrower than that, plainly stated.

The Breach Is Old News. The Exposure Isn't.

Credentials stolen in this campaign will likely keep getting used well after the headlines fade. That's the FBI's warning, and the VECT ransomware confirmation above is proof that's already happening, not a hypothetical.

A broader lesson holds regardless of which layer gets hit. More systems between a person and an AI model, whether infrastructure a company controls or content someone types, means more to protect.

It also means knowing who controls each layer matters more. That accountability doesn't expire when the headlines move on.

Written by

Selvam Sivakumar

Founder, Elephas.app

Selvam Sivakumar is the founder of Elephas and an expert in AI, Mac apps, and productivity tools. He writes about practical ways professionals can use AI to work smarter while keeping their data private.

LinkedInFollow